Improvements to PKCS1Encoding

1 files changed, 138 insertions, 138 deletions

diff --git a/crypto/src/crypto/encodings/Pkcs1Encoding.cs b/crypto/src/crypto/encodings/Pkcs1Encoding.cs
index 299d0ddb0..dac560d76 100644
--- a/crypto/src/crypto/encodings/Pkcs1Encoding.cs
+++ b/crypto/src/crypto/encodings/Pkcs1Encoding.cs
@@ -1,7 +1,7 @@
 using System;
+using System.Threading;
 
 using Org.BouncyCastle.Crypto.Parameters;
-using Org.BouncyCastle.Crypto.Digests;
 using Org.BouncyCastle.Security;
 using Org.BouncyCastle.Utilities;
 
@@ -31,17 +31,18 @@ namespace Org.BouncyCastle.Crypto.Encodings
          */
         public static bool StrictLengthEnabled
         {
-            get { return strictLengthEnabled[0]; }
-            set { strictLengthEnabled[0] = value; }
+            get { return Convert.ToBoolean(Interlocked.Read(ref m_strictLengthEnabled)); }
+            set { Interlocked.Exchange(ref m_strictLengthEnabled, Convert.ToInt64(value)); }
         }
 
-        private static readonly bool[] strictLengthEnabled;
+        private static long m_strictLengthEnabled = 0;
 
         static Pkcs1Encoding()
         {
             string strictProperty = Platform.GetEnvironmentVariable(StrictLengthEnabledProperty);
+            bool strictLengthEnabled = strictProperty == null || Platform.EqualsIgnoreCase("true", strictProperty);
 
-            strictLengthEnabled = new bool[]{ strictProperty == null || Platform.EqualsIgnoreCase("true", strictProperty) };
+            m_strictLengthEnabled = Convert.ToInt64(strictLengthEnabled);
         }
 
 
@@ -59,8 +60,7 @@ namespace Org.BouncyCastle.Crypto.Encodings
          *
          * @param cipher
          */
-        public Pkcs1Encoding(
-            IAsymmetricBlockCipher cipher)
+        public Pkcs1Encoding(IAsymmetricBlockCipher cipher)
         {
             this.engine = cipher;
             this.useStrictLength = StrictLengthEnabled;
@@ -139,46 +139,38 @@ namespace Org.BouncyCastle.Crypto.Encodings
                 :	baseBlockSize - HeaderLength;
         }
 
-        public byte[] ProcessBlock(
-            byte[]	input,
-            int		inOff,
-            int		length)
+        public byte[] ProcessBlock(byte[] input, int inOff, int length)
         {
             return forEncryption
                 ?	EncodeBlock(input, inOff, length)
                 :	DecodeBlock(input, inOff, length);
         }
 
-        private byte[] EncodeBlock(
-            byte[]	input,
-            int		inOff,
-            int		inLen)
+        private byte[] EncodeBlock(byte[] input, int inOff, int inLen)
         {
             if (inLen > GetInputBlockSize())
                 throw new ArgumentException("input data too large", "inLen");
 
             byte[] block = new byte[engine.GetInputBlockSize()];
 
+            int lastPadPos = block.Length - 1 - inLen;
             if (forPrivateKey)
             {
-                block[0] = 0x01;                        // type code 1
+                block[0] = 0x01;                                // type code 1
 
-                for (int i = 1; i != block.Length - inLen - 1; i++)
+                for (int i = 1; i < lastPadPos; ++i)
                 {
-                    block[i] = (byte)0xFF;
+                    block[i] = 0xFF;
                 }
             }
             else
             {
-                random.NextBytes(block);                // random fill
+                random.NextBytes(block);                        // random fill
 
-                block[0] = 0x02;                        // type code 2
+                block[0] = 0x02;                                // type code 2
 
-                //
-                // a zero byte marks the end of the padding, so all
-                // the pad bytes must be non-zero.
-                //
-                for (int i = 1; i != block.Length - inLen - 1; i++)
+                // a zero byte marks the end of the padding, so all the pad bytes must be non-zero.
+                for (int i = 1; i < lastPadPos; ++i)
                 {
                     while (block[i] == 0)
                     {
@@ -187,57 +179,92 @@ namespace Org.BouncyCastle.Crypto.Encodings
                 }
             }
 
-            block[block.Length - inLen - 1] = 0x00;       // mark the end of the padding
+            block[lastPadPos] = 0x00;                           // mark the end of the padding
             Array.Copy(input, inOff, block, block.Length - inLen, inLen);
 
             return engine.ProcessBlock(block, 0, block.Length);
         }
 
         /**
-         * Checks if the argument is a correctly PKCS#1.5 encoded Plaintext
-         * for encryption.
-         * 
-         * @param encoded The Plaintext.
-         * @param pLen Expected length of the plaintext.
-         * @return Either 0, if the encoding is correct, or -1, if it is incorrect.
+         * Check the argument is a valid encoding with type 1. Returns the plaintext length if valid, or -1 if invalid.
          */
-        private static int CheckPkcs1Encoding(byte[] encoded, int pLen)
+        private static int CheckPkcs1Encoding1(byte[] buf)
         {
-            int correct = 0;
-            /*
-             * Check if the first two bytes are 0 2
-             */
-            correct |= (encoded[0] ^ 2);
+            int foundZeroMask = 0;
+            int lastPadPos = 0;
 
-            /*
-             * Now the padding check, check for no 0 byte in the padding
-             */
-            int plen = encoded.Length - (
-                      pLen /* Length of the PMS */
-                    +  1 /* Final 0-byte before PMS */
-            );
+            // The first byte should be 0x01
+            int badPadSign = -(buf[0] ^ 0x01);
 
-            for (int i = 1; i < plen; i++)
+            // There must be a zero terminator for the padding somewhere
+            for (int i = 1; i < buf.Length; ++i)
             {
-                int tmp = encoded[i];
-                tmp |= tmp >> 1;
-                tmp |= tmp >> 2;
-                tmp |= tmp >> 4;
-                correct |= (tmp & 1) - 1;
+                int padByte = buf[i];
+                int is0x00Mask = ((padByte ^ 0x00) - 1) >> 31;
+                int is0xFFMask = ((padByte ^ 0xFF) - 1) >> 31;
+                lastPadPos ^= i & ~foundZeroMask & is0x00Mask;
+                foundZeroMask |= is0x00Mask;
+                badPadSign |= ~(foundZeroMask | is0xFFMask);
             }
 
-            /*
-             * Make sure the padding ends with a 0 byte.
-             */
-            correct |= encoded[encoded.Length - (pLen + 1)];
+            // The header should be at least 10 bytes
+            badPadSign |= lastPadPos - 9;
 
-            /*
-             * Return 0 or 1, depending on the result.
-             */
-            correct |= correct >> 1;
-            correct |= correct >> 2;
-            correct |= correct >> 4;
-            return ~((correct & 1) - 1);
+            int plaintextLength = buf.Length - 1 - lastPadPos;
+            return plaintextLength | badPadSign >> 31;
+        }
+
+        /**
+         * Check the argument is a valid encoding with type 2. Returns the plaintext length if valid, or -1 if invalid.
+         */
+        private static int CheckPkcs1Encoding2(byte[] buf)
+        {
+            int foundZeroMask = 0;
+            int lastPadPos = 0;
+
+            // The first byte should be 0x02
+            int badPadSign = -(buf[0] ^ 0x02);
+
+            // There must be a zero terminator for the padding somewhere
+            for (int i = 1; i < buf.Length; ++i)
+            {
+                int padByte = buf[i];
+                int is0x00Mask = ((padByte ^ 0x00) - 1) >> 31;
+                lastPadPos ^= i & ~foundZeroMask & is0x00Mask;
+                foundZeroMask |= is0x00Mask;
+            }
+
+            // The header should be at least 10 bytes
+            badPadSign |= lastPadPos - 9;
+
+            int plaintextLength = buf.Length - 1 - lastPadPos;
+            return plaintextLength | badPadSign >> 31;
+        }
+
+        /**
+         * Check the argument is a valid encoding with type 2 of a plaintext with the given length. Returns 0 if
+         * valid, or -1 if invalid.
+         */
+        private static int CheckPkcs1Encoding2(byte[] buf, int plaintextLength)
+        {
+            // The first byte should be 0x02
+            int badPadSign = -(buf[0] ^ 0x02);
+
+            int lastPadPos = buf.Length - 1 - plaintextLength;
+
+            // The header should be at least 10 bytes
+            badPadSign |= lastPadPos - 9;
+
+            // All pad bytes before the last one should be non-zero
+            for (int i = 1; i < lastPadPos; ++i)
+            {
+                badPadSign |= buf[i] - 1;
+            }
+
+            // Last pad byte should be zero
+            badPadSign |= -buf[lastPadPos];
+
+            return badPadSign >> 31;
         }
 
         /**
@@ -255,31 +282,42 @@ namespace Org.BouncyCastle.Crypto.Encodings
             if (!forPrivateKey)
                 throw new InvalidCipherTextException("sorry, this method is only for decryption, not for signing");
 
-            byte[] block = engine.ProcessBlock(input, inOff, inLen);
-            byte[] fallbackResult = fallback;
-            if (fallbackResult == null)
+            int plaintextLength = this.pLen;
+
+            byte[] random = fallback;
+            if (fallback == null)
             {
-                fallbackResult = SecureRandom.GetNextBytes(SecureRandom.ArbitraryRandom, pLen);
+                random = SecureRandom.GetNextBytes(this.random, plaintextLength);
             }
 
-            byte[] data = (useStrictLength & (block.Length != engine.GetOutputBlockSize())) ? blockBuffer : block;
+            int badPadMask = 0;
+            int strictBlockSize = engine.GetOutputBlockSize();
+            byte[] block = engine.ProcessBlock(input, inOff, inLen);
 
-		    /*
-		     * Check the padding.
-		     */
-            int correct = CheckPkcs1Encoding(data, this.pLen);
+            byte[] data = block;
+            if (block.Length != strictBlockSize)
+            {
+                if (useStrictLength || block.Length < strictBlockSize)
+                {
+                    data = blockBuffer;
+                }
+            }
+
+            badPadMask |= CheckPkcs1Encoding2(data, plaintextLength);
 
-		    /*
-		     * Now, to a constant time constant memory copy of the decrypted value
-		     * or the random value, depending on the validity of the padding.
-		     */
-            byte[] result = new byte[this.pLen];
-            for (int i = 0; i < this.pLen; i++)
+            /*
+             * Now, to a constant time constant memory copy of the decrypted value
+             * or the random value, depending on the validity of the padding.
+             */
+            int dataOff = data.Length - plaintextLength; 
+            byte[] result = new byte[plaintextLength];
+            for (int i = 0; i < plaintextLength; ++i)
             {
-                result[i] = (byte)((data[i + (data.Length - pLen)] & (~correct)) | (fallbackResult[i] & correct));
+                result[i] = (byte)((data[dataOff + i] & ~badPadMask) | (random[i] & badPadMask));
             }
 
-            Arrays.Fill(data, 0);
+            Arrays.Fill(block, 0);
+            Arrays.Fill(blockBuffer, 0, System.Math.Max(0, blockBuffer.Length - block.Length), 0);
 
             return result;
         }
@@ -287,82 +325,44 @@ namespace Org.BouncyCastle.Crypto.Encodings
         /**
         * @exception InvalidCipherTextException if the decrypted block is not in Pkcs1 format.
         */
-        private byte[] DecodeBlock(
-            byte[]	input,
-            int		inOff,
-            int		inLen)
+        private byte[] DecodeBlock(byte[] input, int inOff, int inLen)
         {
             /*
              * If the length of the expected plaintext is known, we use a constant-time decryption.
              * If the decryption fails, we return a random value.
              */
-            if (this.pLen != -1)
-            {
-                return this.DecodeBlockOrRandom(input, inOff, inLen);
-            }
+            if (forPrivateKey && this.pLen != -1)
+                return DecodeBlockOrRandom(input, inOff, inLen);
 
+            int strictBlockSize = engine.GetOutputBlockSize();
             byte[] block = engine.ProcessBlock(input, inOff, inLen);
-            bool incorrectLength = (useStrictLength & (block.Length != engine.GetOutputBlockSize()));
 
-            byte[] data;
-            if (block.Length < GetOutputBlockSize())
+            bool incorrectLength = useStrictLength & (block.Length != strictBlockSize);
+
+            byte[] data = block;
+            if (block.Length < strictBlockSize)
             {
                 data = blockBuffer;
             }
-            else
-            {
-                data = block;
-            }
-
-            byte expectedType = (byte)(forPrivateKey ? 2 : 1);
-            byte type = data[0];
-
-            bool badType = (type != expectedType);
 
-            //
-            // find and extract the message block.
-            //
-            int start = FindStart(type, data);
+            int plaintextLength = forPrivateKey ? CheckPkcs1Encoding2(data) : CheckPkcs1Encoding1(data);
 
-            start++;           // data should start at the next byte
-
-            if (badType | (start < HeaderLength))
-            {
-                Arrays.Fill(data, 0);
-                throw new InvalidCipherTextException("block incorrect");
-            }
-
-            // if we get this far, it's likely to be a genuine encoding error
-            if (incorrectLength)
+            try
             {
-                Arrays.Fill(data, 0);
-                throw new InvalidCipherTextException("block incorrect size");
+                if (plaintextLength < 0)
+                    throw new InvalidCipherTextException("block incorrect");
+                if (incorrectLength)
+                    throw new InvalidCipherTextException("block incorrect size");
+
+                byte[] result = new byte[plaintextLength];
+                Array.Copy(data, data.Length - plaintextLength, result, 0, plaintextLength);
+                return result;
             }
-
-            byte[] result = new byte[data.Length - start];
-
-            Array.Copy(data, start, result, 0, result.Length);
-
-            return result;
-        }
-
-        private int FindStart(byte type, byte[] block)
-        {
-            int start = -1;
-            bool padErr = false;
-
-            for (int i = 1; i != block.Length; i++)
+            finally
             {
-                byte pad = block[i];
-
-                if (pad == 0 & start < 0)
-                {
-                    start = i;
-                }
-                padErr |= ((type == 1) & (start < 0) & (pad != (byte)0xff));
+                Arrays.Fill(block, 0);
+                Arrays.Fill(blockBuffer, 0, System.Math.Max(0, blockBuffer.Length - block.Length), 0);
             }
-
-            return padErr ? -1 : start;
         }
     }
 }